CRITICAL
GHSASUPPLY-CHAIN
LangBot: Authenticated RCE Via MCP Configuration
An authenticated user can run arbitrary commands via MCP config and fully compromise the host.
3 CRIT · 7 HIGH · 1 MED · 1 INFO · THREAT RED · 12 items · Generated in 231s
An authenticated user can run arbitrary commands via MCP config and fully compromise the host.
Unauthenticated attackers can read, write, and delete stored memory data through exposed document API endpoints.
Unvalidated command execution lets attackers run OS commands on the host as the LiteLLM process.
A patched MCP service can still be tricked into SSRF against metadata or internal hosts via DNS rebinding.
Authenticated tenants could access or delete other tenants' workflow backups, exposing secrets and breaking tenant isolation.
Attackers can abuse Gradio file fetching to reach internal services and steal cloud credentials or redirect users to malicious URLs.
Anyone on the reachable network can read, add, search, and delete documents through the exposed API without credentials.
A malicious site can abuse an admin session to send cross-site requests and execute code on the Open WebUI host.
A prompt-injection flaw in an AI agent chain could let malicious instructions reach downstream systems and enable end-to-end compromise.
Policy and coordination news with no specific AI vulnerability, exploit, or affected system described.
Shows LLM-assisted tooling can speed up discovery of real zero-day flaws, raising defender patching and exposure pressure.
A client-side boolean controlled credit access, letting an attacker bypass paywall logic and gain unauthorized service use.